[teamleaderleo]

Why

One GitHub App installation (manaflow-glaeda-route) is shared by about 30 workflows, and CLA policy guard reads on it. CLA policy guard is a required check on main. On 2026-10-28 that installation's hourly budget ran out at 06:44Z. pr-media logged API rate limit exceeded for installation ID 164690637, and the guard, which hides the API error, rejected every pull request into main ("CLA policy validation rejected the proposed policy") until the reset. The CLA quota re-run then turned them green on attempt 2 at about 07:00Z.

In 05:45 to 06:45Z the App-using workflows ran about 2000 times (backend-migrations 322, risk-tier 308, ci 248, merge-freeze 238, ci-queue-janitor 206, ci-failure-attribution 197, pr-media 194, CLA policy guard 147, others under 80).

This PR cuts installation calls where a job gets nothing for them. It does not touch the guard workflow or its validator (they are pinned byte for byte by the trusted validator), the nightly workflows, or the NEXT dev workflows.

What changes

• Narrow read-only mints skip the revoke. actions/create-github-app-token's post step revokes the token with DELETE /installation/token, which is one installation call per mint. A mint scoped only to contents, pull-requests or actions read (data the public repository shows anyway) now sets skip-token-revoke: true. That covers 7 mints: backend-migrations, pr-media plan and tour, CI's admitted-build read, the hosted and owned-pool rescues, and UI tests. A leftover token like that can read only public data, and it expires within the hour on an ephemeral runner. Every other mint is still revoked: any other scope (issues, administration, the org's runners) or any write permission.
• backend-migrations mints only for a changed migration tree. A new trees step compares the base and head backend/db/migrations trees with git, as the files step already did, and the token is minted only when they differ. When they match, nothing reads with the token. The files step is unchanged and still falls back to GITHUB_TOKEN.
• CI failure attribution mints the glaeda-route token only without cmux-bot. Its READ_TOKEN already prefers cmux-bot's token, so the glaeda-route mint beside it went unused on every CI run.
• pr-media plans no job for a CI re-run or a cancelled CI run. The script already skipped re-runs, but only after a read. Cancelled CI runs are about a third of PR CI completions and are nearly always superseded by a newer push, whose own run makes media. workflow_dispatch still plans any pull request. pr-media is not a required check.
• The installation's budget is now measured. The CLA quota re-run logs glaeda-route App budget: R of L left, U used, resets T every pass. The rate_limit read is free.

Estimated installation calls, per hour, at the 05:45 to 06:45Z volume

source	before	after
backend-migrations mint and revoke (about 350 runs)	~350	~0 (only PRs that change migrations)
ci-failure-attribution unused mint and revoke (about 195 runs)	~195	0
pr-media plans for re-runs and cancelled CI (about 65 of 180)	~200 (2 to 4 reads plus the revoke each)	0
revokes of the narrow read-only mints (pr-media, CI's admitted-build read, rescues, UI tests)	~300	0
total cut		about 1,050 calls per hour

The before numbers are run counts from the Actions API multiplied by calls per run read from the scripts. The new budget log gives the measured after number.

Tests

tests/test_glaeda_route_app_budget.py pins the following, and fails on main's workflows (18 failures):

• every contents, pull-requests or actions read-only glaeda-route mint outside the exempt files skips the revoke, and every other mint (any other scope, or any write) keeps it;
• both lazy mint conditions, with the trees step run against real git repositories (a UI-only head gives same=true, a migration head gives same=false);
• the pr-media plan filter;
• the budget log step.

These existing suites still pass: test_backend_migrations_plan, test_ci_workflow_run_api_budget, test_ci_pr_media, test_ci_quota_hold_gate, test_ci_classify_failures, test_ci_pr_runner_pool, test_ci_required_checks_have_no_path_filters, test_ci_workflow_run_sources and test_cla_quota_rerun. actionlint shows no new findings.

Risk

Low. No required check's verdict logic changes. The one behavior change is that pr-media no longer tours a head whose CI run was cancelled and not re-run; a dispatch still does.

Agent session: agent session

🤖 Generated with Claude Code

Summary by CodeRabbit

• CI Improvements
  • Backend migration checks request access only when migration files change, avoiding unnecessary access requests for unrelated updates.
  • Media checks skip reruns and cancelled workflow runs while keeping manual runs eligible.
  • CI workflows retain required access for the duration of their tasks, and quota usage is logged to help diagnose rate-limit issues.
• Tests
  • Added coverage for migration-change detection, workflow run selection, access handling, and quota reporting.

[teamleaderleo]

Owned by an agent session · session

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[cmux-bot]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Passes: CI passes on 2ccd95f008.

CI passes on 2ccd95f008 (run 40650629553 attempt 1).

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

CI fast guards passes on 2ccd95f008 (run). This covers only the fast guards, not CI: CI's result is ci-status.

Merge receipt for 2ccd95f008: every check was green at merge (13 verified; 15 skipped by policy). Full suite runs on main after merge.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: manaflow-ai/cmux
• Branch: ci/glaeda-route-app-budget
• File: .coderabbit.yaml
• Commit: 2ccd95f
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: adef2ec9-0350-49ed-a471-abbbc63cd1d1

Commits

Reviewing files that changed from the base of the PR and between 70cd00b and 2ccd95f.

Files selected for processing: 2

• .github/workflows/ci-guards.yml
• tests/test-execution.toml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

The workflows now conditionally mint glaeda-route tokens, skip revocation for selected read tokens, and log installation quota data. Tests cover token scopes, workflow conditions, migration-tree comparisons, and quota logging.

Changes: GitHub App Token Budget Controls

Layer / File(s)	Summary
Token lifecycle and selection .github/workflows/ci*.yml, .github/workflows/pr-media.yml, .github/workflows/backend-migrations.yml, tests/test_glaeda_route_app_budget.py, .github/workflows/ci-guards.yml, tests/test-execution.toml	Selected token-mint steps set skip-token-revoke: true. Failure attribution mints glaeda-route only when the cmux-bot token output is empty. Tests check eligible token scopes, revocation settings, and the fallback condition. The guard workflow and execution registry include the tests.
Conditional token minting .github/workflows/backend-migrations.yml, .github/workflows/pr-media.yml, tests/test_glaeda_route_app_budget.py	Backend migration token minting depends on whether migration trees differ. The pr-media plan excludes CI reruns and cancelled CI runs; manual dispatches remain eligible. Tests check the migration comparison and run-selection conditions.
Installation quota logging .github/workflows/ci-cla-quota-rerun.yml, tests/test_glaeda_route_app_budget.py	The workflow logs rate-limit data for the glaeda-route App token. Tests check the token, API command, and error handling.

Priority: High

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Possibly related PRs

• manaflow-ai/cmux#25326: Introduced the CLA quota rerun process that this change updates with installation budget reporting.
• manaflow-ai/cmux#17122: Changed the backend migration fast path and fallback used by the migration-tree comparison.
• manaflow-ai/cmux#25224: Introduced the glaeda-route read-token path in ci.yml and changed failure-attribution token use.

Merge Risk: Minimal · up to 2ccd9

No merge-blocking risk is identified in the reviewed changes.

Pre-merge checks: 23 · 2

Failed checks: 2 warnings

Check name	Status	Explanation	Resolution
Description check		The description clearly explains the incident, changed behavior, testing, estimated impact, and risk. It does not follow the repository template because it omits the required Summary, Changelog, Proof…	Reformat the description to include Summary, Testing, Changelog, Proof, and Checklist. Move the existing Why and What changes content into Summary, rename Tests to Testing, add none under Changelog for this internal CI change, state that …
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 23 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: reducing glaeda-route App budget usage to jobs that require it.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Cmux Cloud Persistent Session And Early Input		PASS: The PR changes only GitHub workflow token-budget logic, quota logging, and related tests. The diff introduces no Cloud terminal creation, cmux-tui client or transport, manual renderer, PTY readi…
Cmux Swift Actor Isolation		The pull request changes only GitHub Actions workflow YAML, TOML test configuration, and a Python test file. It introduces no Swift or Swift-related production code, so the actor-isolation failure con…
Cmux Swift Blocking Runtime		The pull request changes only GitHub Actions YAML, TOML, and Python files. It introduces no production Swift changes, so it does not introduce or expand Swift blocking or timing-based synchronization.
Cmux Browser Automation Off-Main		The pull request changes only GitHub workflows, test registration, and a Python budget test. It does not change Sources/TerminalController.swift, ControlCommandExecutionPolicy.swift, browser socke…
Cmux Expensive Synchronous Load		The pull request changes only GitHub workflow files, Python tests, and test configuration. The reviewed diff contains no Swift files or production Swift changes, so it cannot add or move an expensive …
Cmux Cache Substitution Correctness		PASS: The pull request changes only GitHub Actions YAML, Python tests, and TOML. It does not change production Swift, TypeScript, or JavaScript, so it cannot introduce the specified cache substitution…
Cmux No Hacky Sleeps		PASS: The PR changes only GitHub Actions YAML, TOML, and a Python test file. The rule excludes workflow YAML, and the Python additions are test scaffolding. No changed TypeScript, JavaScript, shell, o…
Cmux Algorithmic Complexity		The production diff adds two direct Git tree lookups, one rate-limit API query, token conditions, and workflow predicates. It does not add nested collection scans, per-target rescans, repeated sorting…
Cmux Swift Concurrency		The reviewed range changes only GitHub workflow YAML, TOML, and a Python test. It contains no Swift, Objective-C, or Objective-C++ files. Therefore, it does not introduce or expand legacy Swift concur…
Cmux Swift @Concurrent		PASS: The pull request changes GitHub Actions workflows, a TOML registry, and a Python test. The authoritative diff contains no Swift files or Swift code, so the @concurrent check is not applicable.
Cmux Swift Package Boundaries		PASS: The pull request changes only GitHub workflow files, a TOML test registry, and a Python test. The authoritative diff contains no Swift production changes, so the Swift package-boundary rule does…
Cmux Swiftpm Lockfiles		PASS: The PR changes only GitHub Actions workflows and Python/TOML tests. The authoritative diff contains no cmux package .gitignore, Package.swift, Package.resolved, or Xcode project/workspace …
Cmux Swift Logging		The pull request changes only GitHub workflow files and Python/TOML test files. It changes no Swift file and adds no app/runtime Swift logging. The new gh api rate_limit output is CI workflow diagno…
Cmux User-Facing Error Privacy		PASS. The diff changes only GitHub Actions workflows and guard tests. The added glaeda-route budget line is an operator diagnostic in CI logs, and the migration-tree output is internal workflow outp…
Cmux Full Internationalization		PASS. The pull request changes only GitHub Actions workflows, test registration, and a test module. The added workflow comments and quota output are operational logs, and the Python text is test/devel…
Cmux Swiftui State Layout		The pull request changes only GitHub Actions workflows, a TOML test registry, and a Python test. It changes no Swift or SwiftUI code, so the SwiftUI state-layout failure conditions do not apply.
Cmux Architecture Rethink		The pull request changes only GitHub workflow files, a TOML test registry, and a Python test file. The authoritative diff contains no Swift files or Swift architecture changes, so the Swift architectu…
Cmux Swift Auxiliary Window Close Shortcuts		PASS: The pull request changes only GitHub workflow files, a TOML registry, and a Python test. It adds or changes no Swift code, so the auxiliary-window close-shortcut rule does not apply.
Cmux Source Artifacts		PASS. The diff contains only workflow configuration, test-lane configuration, and an intentional Python regression test. No local output, generated logs, screenshots, recordings, scratch directories, …
Cmux No Test Or Debug Seam In Production Source		The pull request changes only GitHub workflow files and Python/TOML test configuration. It changes no Swift file under a production Sources/ path, so the specified production test/debug seam conditi…

Full details: Cmux Cloud Persistent Session And Early Input

Explanation

PASS: The PR changes only GitHub workflow token-budget logic, quota logging, and related tests. The diff introduces no Cloud terminal creation, cmux-tui client or transport, manual renderer, PTY readiness gate, input routing, authentication fence, revision fence, or lease change. The cmux-bot reference is only a token-selection condition.

Full details: Cmux Swift Actor Isolation

Explanation

The pull request changes only GitHub Actions workflow YAML, TOML test configuration, and a Python test file. It introduces no Swift or Swift-related production code, so the actor-isolation failure conditions do not apply.

Full details: Cmux Browser Automation Off-Main

Explanation

The pull request changes only GitHub workflows, test registration, and a Python budget test. It does not change Sources/TerminalController.swift, ControlCommandExecutionPolicy.swift, browser socket commands, WebKit/AppKit routing, or related policy tests. The browser automation rule is therefore not applicable.

Full details: Cmux Expensive Synchronous Load

Explanation

The pull request changes only GitHub workflow files, Python tests, and test configuration. The reviewed diff contains no Swift files or production Swift changes, so it cannot add or move an expensive synchronous agent-history load onto the main actor or an interactive path.

Full details: Cmux Cache Substitution Correctness

Explanation

PASS: The pull request changes only GitHub Actions YAML, Python tests, and TOML. It does not change production Swift, TypeScript, or JavaScript, so it cannot introduce the specified cache substitution defect.

Full details: Cmux No Hacky Sleeps

Explanation

PASS: The PR changes only GitHub Actions YAML, TOML, and a Python test file. The rule excludes workflow YAML, and the Python additions are test scaffolding. No changed TypeScript, JavaScript, shell, or production runtime file introduces a sleep, timer, polling loop, or wall-clock synchronization delay. The workflow timeout-minutes: 1 is an execution limit, not a hacky sleep.

Full details: Cmux Algorithmic Complexity

Explanation

The production diff adds two direct Git tree lookups, one rate-limit API query, token conditions, and workflow predicates. It does not add nested collection scans, per-target rescans, repeated sorting/filtering, in-memory joins, or a slower algorithm for a scalable data path. The new Python file is test-only and is exempt by the rule.

Full details: Cmux Swift Concurrency

Explanation

The reviewed range changes only GitHub workflow YAML, TOML, and a Python test. It contains no Swift, Objective-C, or Objective-C++ files. Therefore, it does not introduce or expand legacy Swift concurrency patterns.

Full details: Cmux Swift Package Boundaries

Explanation

PASS: The pull request changes only GitHub workflow files, a TOML test registry, and a Python test. The authoritative diff contains no Swift production changes, so the Swift package-boundary rule does not apply.

Full details: Cmux Swiftpm Lockfiles

Explanation

PASS: The PR changes only GitHub Actions workflows and Python/TOML tests. The authoritative diff contains no cmux package .gitignore, Package.swift, Package.resolved, or Xcode project/workspace changes, and no SwiftPM dependency changes. The SwiftPM lockfile conditions are therefore not triggered.

Full details: Cmux Swift Logging

Explanation

The pull request changes only GitHub workflow files and Python/TOML test files. It changes no Swift file and adds no app/runtime Swift logging. The new gh api rate_limit output is CI workflow diagnostics, not production Swift logging.

Full details: Cmux User-Facing Error Privacy

Explanation

PASS. The diff changes only GitHub Actions workflows and guard tests. The added glaeda-route budget line is an operator diagnostic in CI logs, and the migration-tree output is internal workflow output. No changed text has a concrete path to a cmux end user through the product UI, CLI, or API. The rule also explicitly allows internal CI diagnostics and tests.

Full details: Cmux Full Internationalization

Explanation

PASS. The pull request changes only GitHub Actions workflows, test registration, and a test module. The added workflow comments and quota output are operational logs, and the Python text is test/developer content. No Swift UI text, app catalog or Info.plist entry, web UI/API copy, rendered markdown, changelog, or locale-specific message entry changes are present.

Full details: Cmux Architecture Rethink

Explanation

The pull request changes only GitHub workflow files, a TOML test registry, and a Python test file. The authoritative diff contains no Swift files or Swift architecture changes, so the Swift architectural-rethink failure conditions do not apply.

Full details: Cmux Source Artifacts

Explanation

PASS. The diff contains only workflow configuration, test-lane configuration, and an intentional Python regression test. No local output, generated logs, screenshots, recordings, scratch directories, caches, build output, dependency checkout, or broad artifact directory enters source control.

Full details: Cmux No Test Or Debug Seam In Production Source

Explanation

The pull request changes only GitHub workflow files and Python/TOML test configuration. It changes no Swift file under a production Sources/ path, so the specified production test/debug seam condition is not applicable.

Full details: Description check

Explanation

The description clearly explains the incident, changed behavior, testing, estimated impact, and risk. It does not follow the repository template because it omits the required Summary, Changelog, Proof, and Checklist sections.

Resolution

Reformat the description to include Summary, Testing, Changelog, Proof, and Checklist. Move the existing Why and What changes content into Summary, rename Tests to Testing, add none under Changelog for this internal CI change, state that Proof is not applicable because the change is CI-only, and complete the checklist with applicable items checked or explained.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 7 functions across 1 files. (2 skipped: 2 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}